Grade One Press

Technology reporting you can check

News · Security & privacy

CISA urges immediate patching of critical php2shell remote code flaws in PHP

The US Cybersecurity and Infrastructure Security Agency issued an urgent alert warning that two critical remote code execution vulnerabilities in PHP require immediate patching across internet-facing servers.

Grade One Newsroom · How this is written ↗ · 1 min read

Sources: 1 · top grade 1How evidence is graded

CISA issues emergency alert warning of critical php2shell remote code execution in PHP

Grade 1 · Primary

Source: Cybersecurity and Infrastructure Security Agency

What changed
CISA issued an urgent cybersecurity alert warning of two critical remote code execution flaws affecting PHP installations, urging organizations to patch or disconnect vulnerable servers.
Who it affects
Public and private organizations operating web servers running PHP versions 8.2 through 8.5.
What it does not tell you
The alert did not confirm active in-the-wild exploitation at publication time, but CISA warned that public exploit details create immediate risk.

The full story Check the source

The Cybersecurity and Infrastructure Security Agency issued an urgent alert on 21 October 2026 urging organizations to immediately patch two critical vulnerabilities in the PHP scripting language [1].

The flaws, designated CVE-2026-109618 and CVE-2026-109619 and collectively tracked as php2shell, allow unauthenticated remote attackers to execute arbitrary code on web servers handling HTTP requests [1]. CISA advised administrators to update to fixed releases across the 8.2, 8.3, 8.4, and 8.5 release branches [1].

For organizations unable to patch immediately, or those operating unsupported versions such as PHP 8.1, the agency recommended taking affected systems offline until mitigations are implemented [1].

What it measures

Federal vulnerability warning and mitigation directives governing core web application runtime infrastructure across public and private networks [1].

What it does not tell you

The alert does not disclose whether threat actors have weaponized the flaws in automated scanning campaigns or quantify how many exposed endpoints remain unpatched [1].

Sources and their grades

  1. Cybersecurity and Infrastructure Security Agency, Critical Vulnerabilities in PHP Require Immediate Patching. Read 22 October 2026. Grade 1 · Primary Official CISA Alert regarding CVE-2026-109618 and CVE-2026-109619.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under CISA Cybersecurity PHP Remote code execution Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all